--- title: "45 CFR 160.312 HIPAA: Secretarial action regarding complaints and compliance reviews" canonical: "https://dposchool.com/hipaa/section/160.312" source: "https://www.ecfr.gov/current/title-45/section-160.312" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 160.312 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart C: Compliance and Investigations # 45 CFR 160.312 HIPAA: Secretarial action regarding complaints and compliance reviews eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 160.312(a) **(a)** Resolution when noncompliance is indicated. (1) If an investigation of a complaint pursuant to § 160.306 or a compliance review pursuant to § 160.308 indicates noncompliance, the Secretary may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means. Informal means may include demonstrated compliance or a completed corrective action plan or other agreement. #### 45 CFR 160.312(a)(2) **(2)** If the matter is resolved by informal means, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing. #### 45 CFR 160.312(a)(3) **(3)** If the matter is not resolved by informal means, the Secretary will— ##### 45 CFR 160.312(a)(3)(i) **(i)** So inform the covered entity or business associate and provide the covered entity or business associate an opportunity to submit written evidence of any mitigating factors or affirmative defenses for consideration under §§ 160.408 and 160.410 of this part. The covered entity or business associate must submit any such evidence to the Secretary within 30 days (computed in the same manner as prescribed under § 160.526 of this part) of receipt of such notification; and ##### 45 CFR 160.312(a)(3)(ii) **(ii)** If, following action pursuant to paragraph (a)(3)(i) of this section, the Secretary finds that a civil money penalty should be imposed, inform the covered entity or business associate of such finding in a notice of proposed determination in accordance with § 160.420 of this part. ### 45 CFR 160.312(b) **(b)** Resolution when no violation is found. If, after an investigation pursuant to § 160.306 or a compliance review pursuant to § 160.308, the Secretary determines that further action is not warranted, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[78 FR 5690, Jan. 25, 2013\] [45 CFR 160.312 on eCFR](https://www.ecfr.gov/current/title-45/section-160.312) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.312 Previous: [45 CFR 160.310 HIPAA: Responsibilities of covered entities and business associates](https://dposchool.com/hipaa/section/160.310) Next: [45 CFR 160.314 HIPAA: Investigational subpoenas and inquiries](https://dposchool.com/hipaa/section/160.314) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents